Vulnerability Spotlight: Password reset vulnerability in Epignosis eFront
Summary: Cisco Talos disclosed a password reset authentication bypass in Epignosis eFront, tracked as TALOS-2020-1221/CVE-2020-28597, where an attacker who predicts the password reset seed can generate a valid one-time token and reset the password of any account of their choosing. Talos confirmed versions 5.2.17 and 5.2.21 of the learning management system are affected, and worked with Epignosis under its coordinated disclosure policy to resolve the issue and release an update.
What's compelling: A predictable seed turns account recovery into a universal key: anyone who can guess it resets any account on the LMS, including administrator accounts, without ever knowing a password. Talos confirmed the flaw in the same 5.2.x versions many institutions run, so the exposure lasts until the Epignosis update is applied.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-28597
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026